Reading, migrating,...
 
Notifications
Clear all

Reading, migrating, etc. Microsoft Word 4.0 (for Mac) files

Page 1 / 2
gapodaca
(@gapodaca)
New Member

Hello,

I'm fairly new to the digital forensics scene, but have been working with FTK 5.6.0 on a FRED with other various software for about a year now in an academic archives setting.

Very briefly, I created several disk images of floppy disks and was able to extract a number of Microsoft Word 4.0 for Mac files. My dilemma is that upon extracting the files, using QuickView Plus, I am able to view content, but lose the formatting.

My question is there a way in which I can access/view a "faithful" version of these files without having to emulate or purchase an older Mac?

I spent some time searching the internet and the closest to an answer I could get was found in this thread from 2008

https://forum.openoffice.org/en/forum/viewtopic.php?f=7&t=74093

I haven't gone the emulation route, as I'm unsure it would work (not to mention I don't have an Apple ROM), and clicking on the "Converting Word for DOS files" found near the bottom of the thread links out to a Patreon account.

Any help would be greatly appreciated!

Thanks

Quote
Topic starter Posted : 21/02/2018 8:20 pm
UnallocatedClusters
(@unallocatedclusters)
Senior Member

I have found Passmark's OSForensics tool to be the most capable forensic tool for viewing email files in general.

OSForensics' Email Module has the ability to display email files in HTML or plain text format.; HTML will display emails with your desired original formatting.

I have also had success viewing and analyzing email files with GetData's Forensic Explorer and Magnet Forensics' Internet Evidence Finder.

For a free options you could try

Autopsy/Sleuthkit https://www.sleuthkit.org/autopsy/download.php

PST Viewer https://www.nucleustechnologies.com/pst-viewer.html

ReplyQuote
Posted : 21/02/2018 11:22 pm
jaclaz
(@jaclaz)
Community Legend

I have found Passmark's OSForensics tool to be the most capable forensic tool for viewing email files in general.

Is Word (for Mac 4.0) an e-mail program? ? 😯

@gapodaca

It is not that much difficult to procure a Mac ROM image, point is more like whether it is legal to procure and use one, and as well a legal copy of Word for Mac.

The first is up to you to decide, the good news are that PCE-Plus includes both a ROM and a a "configured MAC", including Word (4.0a),
http//www.hampa.ch/pce/pce-macplus.html
http//www.hampa.ch/pub/pce/pce-0.2.2-macplus.zip
released by archive.org (that thus should be fine to use)
https://archive.org/details/mac_MacOS_7.0.1_compilation

jaclaz

ReplyQuote
Posted : 22/02/2018 11:32 am
gapodaca
(@gapodaca)
New Member

@jaclaz

Pardon my ignorance, but now comes the hard part of trying to open the files I have within the emulator. (I downloaded PCE-Plus.)

Might you have some idea where I can find this documentation? I've tried researching on my own account, but all I've found has not been fruitful.

Many thanks for the initial suggestion.

gapodaca

ReplyQuote
Topic starter Posted : 22/02/2018 3:42 pm
jaclaz
(@jaclaz)
Community Legend

@jaclaz

Pardon my ignorance, but now comes the hard part of trying to open the files I have within the emulator. (I downloaded PCE-Plus.)

Might you have some idea where I can find this documentation? I've tried researching on my own account, but all I've found has not been fruitful.

Many thanks for the initial suggestion.

gapodaca

You need to get HFV explorer (it is as well freeware, though it has no site anymore), find it here
https://www.emaculation.com/doku.php/hfvexplorer

There are a few caveats (the tool is old and is somewhat counterintuitive for someone not having fought already this and many other similar usability battles).

You want to use it to create (File->Format new volume) a new floppy, 1440 Kb, call it "myfloppy" .
Save it as (say) floppy.dsk (the .dsk extension is needed) in the same directory you have pce-plus.
It will appear on the left ABOVE the C\ drive.
Then, from within HFV you navigate to a local folder, let's say C\Wordfiles where you have the Word 4.0 files, select a few ones (less than the 1440 Kb the image allows) and Edit->Copy.
Then navigate back to "myfloppy" and Edit->paste.

Close HFV explorer.

Either rename "floppy.dsk" to "disk2.img" or edit (notepad will do) the pce-mac-plus.cfg (I am assuming you are using pce-mac-plus.batto launch the pce-plus emulator) file, changing the "disk2.img" in it to "floppy.dsk".

Start the pce-plus emulator.
After a small delay you should see the "myfloppy" appear on the desktop.
If you open it you should be able to see the files you copied to it, hopefully with the right "association" with Word.

jaclaz

ReplyQuote
Posted : 22/02/2018 4:11 pm
gapodaca
(@gapodaca)
New Member

Thank you so very much for your detailed instructions. I was able to create the "myfloppy" HDD and was even successful in copying some files into it.

However, I think I may have messed up on my part when it comes to extracting the files. Using FTK, I'm able to identify the file format of the documents – which is how I *theoretically* know that they are Word 4.0 for Mac. Which leaves me wondering if *something* is going on once I export the files from the disk image (using FTK) and save it on an external HD to then later transfer to my workstation running the emulator (perhaps an association is being created with the version of Word I have installed on my computer – though, it retains the .doc extension…). As a side note, I ran all three emulators that PCE-Plus offers pce-mac-classic.bat, pce-mac-plus.bat, and pce-mac-se.bat, to no avail.

I will investigate further and see if I am somehow *tainting* the integrity of the file either during extraction or transfer, or may try installing the emulator on the FRED. Any insights, as always, would be greatly appreciated.

Again, thank you so much!

ReplyQuote
Topic starter Posted : 22/02/2018 4:54 pm
jaclaz
(@jaclaz)
Community Legend

Thank you so very much for your detailed instructions. I was able to create the "myfloppy" HDD and was even successful in copying some files into it.

However, I think I may have messed up on my part when it comes to extracting the files. Using FTK, I'm able to identify the file format of the documents – which is how I *theoretically* know that they are Word 4.0 for Mac. Which leaves me wondering if *something* is going on once I export the files from the disk image (using FTK) and save it on an external HD to then later transfer to my workstation running the emulator (perhaps an association is being created with the version of Word I have installed on my computer – though, it retains the .doc extension…). As a side note, I ran all three emulators that PCE-Plus offers pce-mac-classic.bat, pce-mac-plus.bat, and pce-mac-se.bat, to no avail.

I will investigate further and see if I am somehow *tainting* the integrity of the file either during extraction or transfer, or may try installing the emulator on the FRED. Any insights, as always, would be greatly appreciated.

Again, thank you so much!

You are welcome )

Try doing it the other way around.

I mean, get "out" of the emulator one of the "sample" Word 4.0 files, use HFV explorer to copy it from the floppy to a local hard disk partition, then do to it the same "procedure" you did with FTK and finally try again to insert it to the floppy via HFV explorer.

This way you can maybe understand what happens.

But I am perplexed by your mention of a .doc file extension, a file on Mac has no "extension", it has a MIME type (and in some case a "resource fork", cannot really remember if Word files have it) this is why I hinted about "association" with Word being effective (or not).

At the time, some 25-30 years ago it was a PITA to exchange data between System 7/8 and DOS/Windows, so I am not surprised that some hiccups are happening.

The format should be the same as that of Word 1/2 for Windows
https://en.wikipedia.org/wiki/Microsoft_Word#File_extensions

Maybe the *whatever* parser got the wrong type?

jaclaz

ReplyQuote
Posted : 22/02/2018 5:58 pm
gapodaca
(@gapodaca)
New Member

Thank you for your speedy reply!

Re your first suggestion about "doing it the other way around"…

The first time I tried this, I copied and pasted one of the resume documents that Word offers into the floppy disk (disk2.img) within the emulator, closed the emulator, opened HFV explorer, but didn't see the volume I had created listed on the left pane. I thought, hmm, maybe don't close the emulator before opening up HFV explorer, but on my second try, that didn't work either. So any clarification/guidance on that topic would be welcome.

The possibility of uploading a single disk image created from one of the floppies I am working with also occurred to me, but upon File->Create new volume, I don't believe HFV explorer opens up .img files. Upon further investigation, I came across a thread that mentioned using EMT4PM Diskette Imager to convert the .img to .dsk, but alas, I received an error message saying that the app could not run on my PC (Win10, x64) which does not come as a real surprise.

So I leave you with two questions, I suppose. As always, any help would be greatly appreciated!

ReplyQuote
Topic starter Posted : 22/02/2018 7:54 pm
gapodaca
(@gapodaca)
New Member

Brief update

Was able to get the sample file from the emulator. Just changed the name back from disk2.img to floppy.img!

When I ran it through FTK, the extension was missing, but the program "categorizes" it correctly as a Microsoft Word 4 (Mac) file. When viewing within FTK, the file looks the same as it did within the emulator.

So I guess I'm left wondering if I can upload the disk image and open it within the emulator and see if it opens in there. I have a physical floppy disk drive, if it helps (though I'm sure getting the drive and emulator to communicate is an entirely different can of worms…)

Thanks in advance!

ReplyQuote
Topic starter Posted : 22/02/2018 8:11 pm
jaclaz
(@jaclaz)
Community Legend

Open in HFV explorer the floppy where you copied one of the sample files from within the emulator.

Right click on it and choose properties.
Very likely that file has
TypeWDBN
CreatorMSWD

Now click on one of the files you got (already copied to the floppy, NOT on your windows filesystem) let's say the file is called "mytest" and do the same.

Very likely that file has
Type????
CreatorUNIX

Change/edit the Type and Creator to WDBN and MSWD. (the fields are CaSe SeNsItIvE, so those must be ALL CAPITALS)

Close HFV explorer and try starting the emulator.

Now if you double click in the emulator on the "mytest" in the floppy it should open in Word. (and it also should have the Word icon).

jaclaz

ReplyQuote
Posted : 22/02/2018 8:59 pm
gapodaca
(@gapodaca)
New Member

Some mild success…

Upon my first try, I followed your instructions, though the 'Type' and 'Creator' fields were blank. Don't know if that may be an indication that they are *not* what I'm purporting them to be, but I changed them in Properties and was able to get the file icon for the file to show as MS Word.

Upon trying to open the first file, however, I got an "Sorry, a system error occurred. 'Microsoft Word' illegal instruction" error message with the only option being to restart.

When I tried with a second file, I got an "Not enough memory to run Word" error message. Which lead me to create a new volume in HFV explorer with a larger volume size, but still garnering the same error.

I truly apologize for the back and forth on this, but your help is really proving to be a treasure trove. If anything, it's a great way for me to get my feet wet.

I'm tempted to mess with the .cfg file and up the size, but I wouldn't even know where to start, let alone know if that would even work.

Thanks for your continued support!

ReplyQuote
Topic starter Posted : 22/02/2018 9:52 pm
gapodaca
(@gapodaca)
New Member

Brief aside

I tried a third time with a smaller file and was able to open it! … but, still received an error message "Sorry, a system error occurred. 'Microsoft Word' bad F-line instruction" with the only option at that point being to restart.

I could see the text in the background, though! So, some progress…maybe…

ReplyQuote
Topic starter Posted : 22/02/2018 9:57 pm
jaclaz
(@jaclaz)
Community Legend

Yes it is very possible that now the issue is the emulator, either being limited (not enough RAM) or having some incompatibility with Word (which probably is a "pesky" program).

You could try a Basilisk II install.
It is a tad bit more complex to install/setup but it has a GUI configuration tool that allows to easier try different settings for memory/Mac model/CPU, etc. (and has colour screen and various (higher) resolutions available.

Here
https://www.emaculation.com/doku.php/basilisk_ii

https://www.emaculation.com/doku.php/basilisk_ii_setup

I quickly tested it and the archive.org hd images work just fine with it (i.e. you don't need to follow the above guide to install system 7.5.3).

For the test you want to use this exact version
Basilisk II 15/01/2010
http//www.emutopia.com/index.php/emulators/item/317-apple-macintosh-68k/482-basilisk-ii

Once it is setup and working then you can try later versions.

jaclaz

ReplyQuote
Posted : 23/02/2018 10:27 am
gapodaca
(@gapodaca)
New Member

Thank you for your continued help! I will have to put a pin on this until next week when I am back in the office, but it's good to know there are other avenues to explore. I will keep you abreast of any progress made, but sincerely appreciate all the input!

ReplyQuote
Topic starter Posted : 23/02/2018 2:10 pm
jaclaz
(@jaclaz)
Community Legend

Thank you for your continued help! I will have to put a pin on this until next week when I am back in the office, but it's good to know there are other avenues to explore. I will keep you abreast of any progress made, but sincerely appreciate all the input!

No hurry, you already did the first 90% of the work (becoming familiar with HFV explorer and learning to edit Type/Creator) now you only need to do the remaining 90% 😯 i.e. setting up Basilisk II wink .

jaclaz

ReplyQuote
Posted : 23/02/2018 3:19 pm
Page 1 / 2
Share:
Share to...